BeyondTrust EPM Flaw Lets Standard Windows Users Execute Code in Kernel Mode
Brief
BeyondTrust has disclosed two high-severity vulnerabilities in its Endpoint Privilege Management (EPM) product for Windows that could enable local privilege escalation and anti-tamper bypasses on affected endpoints.
Tracked under advisory BT26-04, the flaws affect all versions of BeyondTrust Endpoint Privilege Management (Windows Deployment) released before version 26.
- 2.
The company issued the advisory on August 17, 2026, and said both issues were discovered internally during ongoing security assessments using frontier AI models and proprietary testing harnesses.
BeyondTrust EPM Flaw
The most severe vulnerability, tracked as CVE-2026-40144, carries a CVSS v4 score of 7.3 and stems from an out-of-bounds read issue in a kernel-mode component of the EPM Windows agent.